VORANT. Threat Intelligence Sign in Get the full feed

ShinyHunters exploit PeopleSoft RCE flaw

high threat government-nationaleducationfinancial-services

An unauthenticated RCE in Oracle PeopleSoft PeopleTools is being exploited by the ShinyHunters extortion gang to steal data from over 100 organizations.

CISA/MS-ISAC issued an advisory for CVE-2026-35273, a vulnerability in the Updates Environment Management component of Oracle PeopleSoft Enterprise PeopleTools (versions 8.61-8.62). The flaw allows an unauthenticated attacker with network access via HTTP to achieve remote code execution and fully compromise the underlying system, requiring no user interaction, which makes internet-facing PeopleSoft deployments particularly at risk.

According to reporting cited from Bleeping Computer, the ShinyHunters extortion group is actively exploiting this vulnerability in ongoing data theft campaigns, claiming to have stolen data from over 100 organizations. PeopleSoft is widely deployed by large enterprises, government agencies, and universities for HR, payroll, finance, supply chain, and campus operations, making this a broad-impact target given its role managing sensitive business and personal data.

The advisory recommends immediate patching, vulnerability scanning, network segmentation, least-privilege enforcement, and exploit protection to mitigate risk. Organizations running affected PeopleTools versions should treat this as an urgent patching priority given confirmed active exploitation and data theft.

Mentioned in this report

Vulnerabilities CVE-2026-35273KEV
Threat actors ShinyHunters

Detection guidance

Suspicious Child Process Spawned by PeopleSoft/WebLogic Application Server

ATT&CK T1190

Detects cmd/powershell/shell processes spawned by Java-based PeopleSoft (Tuxedo/WebLogic) application server processes, indicative of RCE exploitation such as CVE-2026-35273. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Child Process from PeopleSoft Application Server
id: 6fa8c4a6-9c02-5e14-a2c1-0ea02673c40a
status: experimental
description: Detects command shell or scripting engine processes spawned by java.exe
  or PeopleSoft/Tuxedo application server binaries (PSAPPSRV, PSAESRV, PSSAMSRV, weblogic),
  which is consistent with post-exploitation command execution following remote code
  execution against PeopleSoft PeopleTools (e.g. CVE-2026-35273).
references:
- https://www.bleepingcomputer.com/
author: Vorant
tags:
- attack.t1190
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  parent_selection:
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
    - \PSAPPSRV.exe
    - \PSAESRV.exe
    - \PSSAMSRV.exe
    - \PSQCKSRV.exe
    - \PSTUXWIN.exe
  child_selection:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \rundll32.exe
    - \mshta.exe
    - \certutil.exe
  filter_admin:
    CommandLine|contains:
    - psadmin
    - PSADMIN
  condition: parent_selection and child_selection and not filter_admin
falsepositives:
- Legitimate PeopleSoft administration scripts invoked via psadmin utilities
- Scheduled maintenance jobs that call scripting engines from the application server
  account
level: high

Webshell File Dropped in PeopleSoft/WebLogic Web Application Directory

ATT&CK T1190

Detects creation of JSP/JSPX/WAR files in typical WebLogic/PeopleSoft deployment or servlet temp directories, a common post-exploitation step after RCE against PeopleSoft PeopleTools. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: JSP Webshell Dropped in WebLogic PeopleSoft Deployment Directory
id: dad9a4e2-a856-508e-8e06-bd6bb19ac8d8
status: experimental
description: Detects the creation of .jsp, .jspx, or .war files within WebLogic/PeopleSoft
  managed server deployment, staging, or servlet temp directories. This behaviour
  is commonly observed after successful exploitation of unauthenticated RCE flaws
  such as CVE-2026-35273 in Oracle PeopleSoft PeopleTools, where attackers drop a
  webshell to maintain access.
references:
- https://www.bleepingcomputer.com/
author: Vorant
tags:
- attack.t1190
- attack.persistence
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
    - \servers\
    - \stage\
    - \tmp\_WL_
    - \applications\
    - \webapps\
    TargetFilename|endswith:
    - .jsp
    - .jspx
    - .war
  filter_deploy:
    TargetFilename|contains:
    - \autodeploy\
  condition: selection and not filter_deploy
falsepositives:
- Legitimate application deployment or redeployment of .war/.jsp artefacts by administrators
- CI/CD pipelines pushing updated PeopleSoft customizations to the application server
level: high

HTTP Requests to PeopleSoft Updates Environment Management Endpoint with Exploit Indicators

ATT&CK T1190

Detects HTTP requests to the PeopleSoft PeopleTools Updates Environment Management component containing anomalous payload characteristics consistent with unauthenticated RCE exploitation attempts (CVE-2026-35273). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Anomalous Request to PeopleSoft Updates Environment Management Component
id: d3dbed48-1c00-57f1-89f4-e976f15efed4
status: experimental
description: Detects HTTP requests to PeopleSoft PeopleTools Updates Environment Management
  URIs that include serialization, command, or scriptlet-like payload markers in the
  request body or query string, indicative of exploitation attempts against CVE-2026-35273.
references:
- https://www.bleepingcomputer.com/
author: Vorant
tags:
- attack.t1190
- attack.initial_access
logsource:
  category: webserver
  product: windows
detection:
  selection_uri:
    cs-uri-stem|contains:
    - UpdatesEnvironmentManagement
    - EnvironmentManagement
  selection_payload:
    cs-uri-query|contains:
    - ProcessBuilder
    - Runtime
    - getRuntime
    - bash -c
    - cmd.exe /c
    - <%
  condition: selection_uri and selection_payload
falsepositives:
- Vulnerability scanning or authorized penetration testing against the PeopleSoft
  environment
- Automated security research tooling probing the Updates Environment Management endpoint
level: medium

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-oracle-peoplesoft-peopletools-could-allow-for-remote-code-execution_2026-059

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free